Extracted

• • Target

    e6214a7d639adc535d21ff1833ea771b0f3bef7eece29d853aa7b0ae29a621e5

  • Size

    1.8MB

  • MD5

    3b63896570d897a201dc7c3599ed3d8c

  • SHA1

    6e8250c1b80c92e7f65ee51f0a25ff97e2b0b7db

  • SHA256

    e6214a7d639adc535d21ff1833ea771b0f3bef7eece29d853aa7b0ae29a621e5

  • SHA512

    7447ba816e00afefba8aeaa43dae1a8b8e41d22b9dc4b152808bbf2e0c68fc32ee51957ed31c880883bc4fd697c4e99efdbb57553009ecb580350fcb47f35beb

  • SSDEEP

    49152:M4hsZXNpHnuoijlp85WyH93aAHz+U5F5:M4spDBWyd39Hzl

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2